Overview

overview

10

Static

static

10

vff.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    vff.exe

  • Size

    45KB

  • MD5

    3e857e2fb2793de1f0310d2443088f82

  • SHA1

    582b81e67f23a93c713b68d432432aace74c731a

  • SHA256

    bc6df9c438db5ef373c33b6c6a16a1dfa70f2d8c66a8352ea1632579225edc76

  • SHA512

    4cf910b7fa9bd39ffaab40789c0f896f26f41b5004f0d4434deb50453131a930998a87a8bc2e0383d3dd982fa473f14ff228cff5bbd46cc1a0d0cf79fb97ffbc

  • SSDEEP

    768:RdhO/poiiUcjlJInGTwH9Xqk5nWEZ5SbTDa6WI7CPW5p:Pw+jjgnLH9XqcnW85SbTTWIR

Score
10/10
xenorat

Malware Config

Extracted

Family

xenorat

C2

agreement-lists.gl.at.ply.gg

Mutex

skibdiitoilet!zzz

Attributes
  • delay

    5000

  • install_path

    nothingset

  • port

    48889

  • startup_name

    nothingset

Signatures

  • Detect XenoRat Payload 1 IoCs
  • Xenorat family
    xenorat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • vff.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections